|
SearchMiracle.AdDownloader Trojan Downloader Information
| Name: |
SearchMiracle.AdDownloader |
| Category: |
Trojan Downloader |
| Advice: |
Remove |
| Risk: |
Elevated Risk
Elevated threats are usually threats that fall into the range of adware in which data about a user's habits are tracked and sent back to a server for analysis without your consent or knowledge. |
| Description:
|
SearchMiracle.AdDownloader installs a memory resident adware application that displays popup ads on the users computer.
SearchMiracle.Downloader connects to the following URLs, which in turn may also open links to other adware-related Web sites:
http://info.searchmiracle.com/popsetarray.php
http://info.searchmiracle.com/update.php
After connecting to thew update page, the trojan then downloads and executes its update package protector_update.exe. Once protector_update.exe is installed the trojan communicates with the URL http://info.searchmiracle.com/popsetarray.php to determine what ads to display to the user.
Sample data:
"http://searchmiracle.com/ads/ad.php?country=1&pos=1|720|300|0|50|||| http://searchmiracle.com/ads/ad.php?country=1&pos=2|739|300|0|50|||| http://searchmiracle.com/ads/ad.php?country=1&pos=3|698|290|0|50|||| http://searchmiracle.com/ads/ad.php?country=1&pos=4|700|500|0|50|||| http://searchmiracle.com/ads/ad.php?country=1&pos=5|752|467|0|50|||| http://searchmiracle.com/ads/ad.php?country=1&pos=3|698|290|0|17180|||| http://searchmiracle.com/ads/ad.php?country=1&pos=3|698|290|0|17280|||| http://searchmiracle.com/ads/ad.php?country=1&pos=3|698|290|0|17280|||| http://searchmiracle.com/ads/ad.php?country=1&pos=3|698|290|0|17280|||| http://searchmiracle.com/ads/ad.php?country=1&pos=1|720|300|0|17180||||"
|
| Signatures:
|
process: protas.exe: MD5 Hash: CCA7F61E2095E805211...
process: protector_update.exe: MD5 Hash: CCA7F61E2095E805211...
process: protector.exe: MD5 Hash: 25b6e2f440cbff32e34...
process: elitebdc32.exe: MD5 Hash: 25B6E2F440CBFF32E34...
process: elitelfh32.exe: MD5 Hash: 25B6E2F440CBFF32E34...
process: protector_update.exe: MD5 Hash: 22ef63bfb229b17ee96...
process: regcleanbundle.exe: MD5 Hash: 8116b7bff33312d3b79...
process: rgbndl_enaxb1.exe: MD5 Hash: bee2c2e90fe644da014.. |
| Type: |
Trojan Downloader - A Trojan software is any software on a user's computer that the user is not aware or intentionally installed. Most Trojan software is designed to perform some sort of actions that could jeopardize the user's security or privacy. |
Top Trojan Downloader Visited Pages:
TrojanDownloader:Win32/Small.ADO - 338 visits
Trojan.Downloader.Slvr - 201 visits
Trojan.Downloader.Small.ADR - Alias: TrojanDownloader:Win32/Small.ADR - 61 visits
Peper - Alias: Backdoor.VB.nb, pepar trojan, Quadro - 55 visits
Bagle.HP - 47 visits
Bagle.BV - 46 visits
Trojan.Downloader.U - 46 visits
Trojan.Dropper.AV - Alias: Troj/Dropper-AV - 44 visits
Trojan.Downloader.Small.HS - Alias: TrojanDownloader:Win32/Small.HS - 41 visits
eXact.Downloader - 41 visits
Random Trojan Downloader Pages:
Agent.MK
Bagle.BW
ZGet - Alias: Downloader-AA trojan, Downloader.cfg trojan, TrojanDownloader.Win32.ZombGet.02.e
Bagle.BU - Alias: TrojanDropper:Win32/Bagle.BU
Small.GN
VividGalut
Trojan.Downloader.izxczxvr
Trojan.Downloader.J
Diabolo - Alias: Diabolo HotFix
NauPoint Installer
|
